Experimental Long-Distance Decoy-State Quantum Key Distribution Based On 

Polarization Encoding 
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We demonstrate the decoy-state quantum key distribution (QKD) with one-way quantum com- 
munication in polarization space over 102 km. Further, we simplify the experimental setup and 
use only one detector to implement the one-way decoy-state QKD over 75 km, with the advantage 
to overcome the security loopholes due to the efficiency mismatch of detectors. Our experimental 
implementation can really offer the unconditionally secure final keys. We use 3 different intensities 
of 0, 0.2 and 0.6 for the light sources in our experiment. In order to eliminate the influences of po- 
larization mode dispersion in the long-distance single-mode optical fiber, an automatic polarization 
compensation system is utilized to implement the active compensation. 

PACS numbers: 03.67.Dd, 42.81. Gs, 03.67.Hk 



Quantum key distribution P, Q can in principle of- 
fer the unconditionally secure private communications 
between two remote parties, Alice and Bob. However, 
the security proofs for the ideal BB84 protocol [1, [B| do 
not guarantee the security of a specific setup in prac- 
tice due to various imperfections there. One important 
problem in practical QKD is the effects of the imper- 
fect source, say, the coherent states. The decoy state 
method @, 0, IH, 0, [l(| or some other methods [TJ [l2| 
can help to generate the unconditionally secure final keys 
even an imperfect source is used by Alice in practical 
QKD. Basically, QKD can be realized in both free space 
and optical fiber [2(. Each option has its own advantages. 
The fiber QKD can be run in the always-on mode: it runs 
in both day and night and is not affected by the weather. 
Also, the future local QKD networks are supposed to be 
using fiber. So far, there are many experiments of fiber 
QKD with weak coherent lights [13(. However, these re- 
sults actually do not offer the unconditional security be- 
cause of the possible photon-number-splitting attack 14 1 . 
Recently, there are also exp erimental implementations of 
the decoy-state method [15| , with two-way quantum com- 
munication. However, since these implementations have 
not taken the specific operations as requested by Ref. [l(| , 
the security of the final keys is still unclear due to the 
so-called Trojan horse attacks Q. One can implement 
active counter-measures [l6| to overcome this problem, 
which is deserved experimental implementations in the 
future. The other way is to use one-way quantum com- 
munication which we have adopted in this work. 

Here we present the first polarization-based decoy- 
state QKD implementation over 102 km with only one- 



way quantum communication using two detectors and 
75 km using only one detector. Our results are uncondi- 
tionally secure (For the unconditional security, we mean 
that the probability that Eve has non-negligible amount 
of information about the final key is exponentially close 



to 0, say, e 
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Here we must clarify that given 



the existing technologies [13|, if the distance is shorter 
than about 20 km, through the simple worst-case estima- 
tion 17[ of the fraction of tagged bits it is still possible 



for one to implement the unconditionally secure QKD 
without using the decoy-state method. 

We can know how to distill the secure final keys with 
imperfect source given the separate theoretical results 
from Ref. [t7| , if we know the upper bound of the fraction 
of tagged bits (those raw bits generated by multi-photon 
pulses from Alice) or equivalently, the lower bound of the 
fraction of untagged bits (those raw bits generated by 
single-photon pulses from Alice). In Wang's 3- intensity 
decoy-state protocol @, H| , one can randomly use 3 differ- 
ent intensities (average photon numbers) of each pulses 
(0, fx, fx') and then observe the counting rates (the count- 
ing probability of Bob's detector whenever Alice sends 
out a state) of pulses of each intensities (So, S^, S^). The 
density operators for the states of \i and fi! (fi! > fx) are 
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here c = 1 - e ^ - fie »,p c = S— Y^=2 ^H n >H> Pd is 
a density operator and d > (here we use the same no- 
tations in Ref. 7, 8]). We denote sq(s' ), si(s[), s c (s' c ) for 
the counting rates of those vacuum pulses, single-photon 
pulses and p c pulses from p fl (p fJi '). Asymptotically, the 
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values of primed symbols here should be equal to those 
values of unprimed symbols. However, in an experiment 
the number of samples is finite therefore they could be 
a bit different. The bound values of s±, s[ can be deter- 
mined by the following joint constraints corresponding to 
Eq.(15) of Ref. H 

( = e~^s + ne'^si + cs c 

{ < < - - e-SJo), (2) 

where si = (1 - -^Lw s' = (1 - -A=)s c , s' = 0, 

sn = (1 + ro)SV) and rn = ,i" .. to obtain the worst-case 
results [3, |8[ . N^,N are the pulse numbers of intensity 
/i. 0. Given these, one can calculate Si, s' 1: s c numerically. 

The experimental setup is shown in Fig.l, mainly in- 
cluding transmitter (Alice), quantum channel, receiver 
(Bob) and electronics system. All the electronics mod- 
ules are designed by ourselves. The synchrodyne (SD) is 
designed by field programmable gate array (FPGA, Al- 
tera Co.) and outputs multiple channels of synchronous 
clocks with independent programmable parameter set- 
tings, which is equivalent to an arbitrary function gen- 
erator, to drive the modules of random number genera- 
tor (RNG), data acquisition (DAQ, designed by FPGA) 
and single-photon detector (SPD) respectively. The sig- 
nals with FWHM of about 1 ns are generated by laser 
diode driver (LDD) to drive 10 distributed feed-back 
laser diodes (LD) at the central wavelength of 1550 nm, 
where 4 LDs are used for decoy states (p) and another 4 
LDs are used for signal states (//) and the other 2 LDs 
are used for polarization calibration. The polarization 
states of photons emitting from LDs can be transformed 
to arbitrary polarization state by polarization controller 
(PC). For decoy states and signal states, the four polar- 
ization states are \H), \V), \+), |— ), where \H), \V) rep- 
resent horizontal polarization and vertical polarization, 
|+) = 1/V2(\H) + \V)) and |-) = 1/V2(\H) - IV}), as 
the four states for the standard BB84 protocol [l(. For 
test states, the two polarization states are \H) and |+) 
to calibrate the two sets of polarization basis. The pho- 
tons of every channel are coupled to an optical fiber via 
fiber coupling network (FCN), which is composed of mul- 
tiple beam splitters (BS) and polarization beam splitters 
(PBS) and optical attenuators. In FCN, the fiber length 
of every channel must be adjusted precisely so that the 
arrival time differences to SPD caused by the fiber length 
differences can be less than 100 ps. 

In the setup, a dense wavelength division multiplexing 
fiber filter (FF) is inserted in Alice's side. On the one 
hand, it can guarantee that the wavelengths of emitted 
photons in all channels are equal to avoid the possibility 
of Eve's attack utilizing the variance of photon wave- 
lengths. On the other hand, it can reduce the influences 
of chromatic dispersion in fiber. 

In the experiment, the pulse numbers ratio of the 3 
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FIG. 1: Schematic diagram of the experimental setup. Solid 
line and dashed line represent optical fiber and electric cable 
respectively. See the text for the abbreviations. 



intensities is 5 : 4 : 1 and the intensities of signal states 
and decoy states are fixed at p! = 0.6 and /i = 0.2 respec- 
tively, which are not necessarily the optimized parame- 
ters with our setup. The fluctuations of intensities are 
monitored at the test point (TP). If the varying range 
of fluctuation is larger than about 5% we will stop the 
system and adjust the light sources. In fact, the effects 
of intensity fluctuation is indeed a very important theo- 
retical problem for the decoy-state QKD, which had not 
been solved by theorists prior to our experiment. Very re- 
cently theoretical progress has shown that the effects are 
moderate with certain modifications of the experimental 
setup [11]. 

After passing through the long-distance single-mode 
fiber (SMF, Corning Co., fiber attenuation is about 
0.2 dB/km), at Bob's side we adopt two kinds of mea- 
surement scheme. In one-detector scheme, firstly a fiber 
BS is used to select the two polarization basis called HV 
basis and H — basis randomly. Secondly due to the polar- 
ization mode dispersion (PMD) effects in long-distance 
SMF, we develop an automatic polarization compensa- 
tion (APC) system to compensate for the PMD actively. 
The principles of APC are: Alice sends fixed \H) states 
or |+) states. Then Bob records the accepted count- 
ing rates in the corresponding basis using DAQ system 
and transmits them to the computer via universal serial 
bus (USB). After algorithmic processing, the computer 
gives out the data, which can be converted to voltages of 
electric polarization controllers (EPC, General Photon- 
ics Co.) through digital-to-analog converter (DAC) and 
high voltage amplifier (HVA). Then the fiber squeezers 
in EPC are driven by the voltages and change the po- 
larization [3] . After repeating feedback controls the vis- 
ibility of test states can reach the target value and the 
APC system stops. The average adjusting time is about 
3 minutes. However, this time can be greatly shortened 
using a continuous coherent light and wavelength division 
multiplexing techniques and optimized algorithms. Fig- 
ure 2(a) shows the test results of the APC system with 
75 km fiber. In the experiment, Alice starts APC to cal- 
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FIG. 2: a) Test of the APC system with 75 km fiber. In posi- 
tion 1 and 2 the APC system monitors the visibility changes 
of polarization states and adjusts the voltages of EPC actively 
to reach the target visibility. Subsequently, the visibility of 
polarization states becomes worse slowly when free running. 
In position 3, artificial disturbance induces drastic change of 
visibility and the APC system can still work well. The time 
interval of points is 2 seconds, b) Comparison of the final key 
rate of signal states per pulse between the theoretical calcula- 
tion and experimental results with four different distance set- 
tings L (13.448 km, 50.524 km, 75.774 km and 102.714 km), 
where their corresponding total attenuations are (24.9 dB, 
32.2 dB, 34.8 dB, 37.0 dB) including channel losses, all the 
insertion losses of components, detector efficiencies etc. The 
first three settings use one-detector scheme and the last one 
uses two-detector scheme. The first two settings' repetition 
frequency is f=4 MHz and the last two is /=2.5 MHz. 



ibrate the system first. After calibration she transmits 
the pulses for several minutes. Then this process is re- 
peated. Thirdly we use two magnetic optical switch (OS, 
Primanex Co.) with switching time of less than 20 /is 
driven by two independent RNG to randomly switch the 
basis and the output ports of PBS respectively. The one- 
detector scheme can overcome the security loopholes due 
to the efficiency mismatch of detectors [20j since the fiber 
lengths of each state can be adjusted identically. On the 
other hand, two OS driven by the same RNG and two 
SPDs [2l[ are used in two-detector scheme to reduce the 
transmission losses in Bob's side. 

We use this all-fiber quantum cryptosystem to imple- 
ment the decoy-state QKD over 102 km and 75 km us- 
ing two-detector scheme and one-detector scheme respec- 
tively. The experimental parameters and their corre- 
sponding values are listed in Table fl] In the experiment, 
Alice totally transmits about N pulses to Bob. After 
the transmission Bob announces the pulse sequence num- 
bers and basis information of received states. Then Alice 
broadcasts to Bob the actual state class information and 
basis information of the corresponding pulses. Alice and 
Bob can calculate the experimentally observed quantum 
bit error rate (QBER) values E^, E^i of decoy states and 
signal states according to all the decoy bits and a small 
fraction of the signal bits respectively [iil ]. 

Then we can numerically calculate a tight lower bound 
of the counting rate of single-photon s[ using Eq. [21 The 
next step is to estimate the fraction of single-photon Ai 



TABLE I: Experimental parameters (P.) and their corre- 
sponding values of 75.774 km (Valuel) and 102.714 km 
(Value2) decoy-state QKD. 



Valuel 



Value2 



Valuel 



Value2 



L 

f 
N 



75.774 km 
2.5 MHz 
1.607 x 10 9 
3.231% 
9.039% 
6.099% 



So 



Rt 46.167 Hz 



102.714 km S, 
2.5 MHz S, 
5.222 x 10 9 
3.580% 
9.098% 
5.854% 
29.427 Hz 



7.534 x 10~ 5 
9.174 x 10~ 6 



81 

Re 

R t 



11.668 Hz 
0.253 



4.611 x 10~ 5 
6.711 x 10 -6 



8.090 Hz 
0.275 



and the QBER upper bound of single-photon E\ . We use 



(3) 



to conservatively calculate Ai of signal states and decoy 
states respectively 0, 1- And E\ of signal states and 
decoy states can be estimated by the following formula, 

P M'(M)_ rp (1 - r )5 e-^W 

E\ - l-VO-i Kq " A i ■ W 

2 V(m) 

Here we consider the statistical fluctuations of the vac- 
uum states to obtain the worst-case results. 

Lastly we can calculate the final key rates of signal 
states using the formula 

01 of 



R,j 



S^A* -HiE^-AlHiE^)), 



(5) 



here H(x) = —xlog-z(x) — (1 — x)log2(l — x). Then we 
compare the experimental final key rate of signal states 
Re with the theoretically allowed value Rt, i.e., in the 
case both Ai and E\ are known without any overestima- 
tion. The theoretically allowed values of Ai and E\ for 
signal states are 
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with the assumptions that the ideal value of the single- 
photon counting rate is s%t — J] + So and S^> = r^i' + So, 
where i] is the overall transmittance. We find out that 
our experimental results in the two cases are both close 
to 30% of the theoretically allowed maximum value. 

During the above calculation, we have used the worst- 
case results in every step for the security. Obviously, 
there are more economic methods for the calculation of 
final key rate. Here we have not considered the consump- 
tion of raw keys for QBER test. Now we reconsider the 
key rate calculation of decoy states above. We assumed 
the worst case of so = (1 + ro)So and so = (1 — 7"o)So for 
calculating A^ and E± respectively. Although we don't 
exactly know the true value of So, there must be one fixed 
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FIG. 3: The final key rate of decoy pulses varies with the 
vacuum counting rate of so in the case of 13.448 km, where 
so = (1 + m)So. 



value for both calculations. Therefore we can choose ev- 
ery possible value in the range of (1 — r )5o < s < 
(1 + ro) So and use it to calculate A^ 1 , and the final 
key rate, and then pick out the smallest value as the lower 
bound of decoy states key rate. Figure 3 demonstrates 
the results with a larger range of |ro| (tq can be negative 
here) than the actual range in the case of 13.448 km. This 
economic calculation method can obtain a more tight- 
ened value of the lower bound, which is larger than the 
result using the simple calculation method above with 
two-step worst-case assumption for sq values. 

We have tested the system with different fiber lengths 
and compared the final key rates with the theoretical 
values, see Fig. 2(b). The differences between them are 
mainly due to the imperfect polarization compensation 
and the possible statistical fluctuation. 

The two measurement schemes have their own advan- 
tages. One-detector scheme can overcome the security 
loopholes of the detector efficiency mismatch and gener- 
ate the unconditionally secure final keys while the other 
can implement longer distance. If we use four-detector 
scheme with four high quality SPDs the final key rate 
and maximum distance will be improved. Also, the bal- 
ance between the efficiency and the dark counts of SPD 
is important. During the experiment, we have even re- 
duced the efficiency of SPD purposely to reduce the dark 
counts to obtain better balance. Hopefully, a low-noise 
and high-efficiency detector at telecommunication wave- 
lengths can be used in the future to further improve the 
final key rate. The superconducting transition-edge sen- 
sor is one of the promising candidates [23j ]. 

In summary, we implement the polarization-based one- 
way decoy-state QKD over 102 km and also implement 
75 km one-way decoy-state QKD using only one detector 
to really offer the unconditionally secure final keys. 

This work is supported by the NNSF of China, the 
CAS and the National Fundamental Research Program. 
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